Implement exact bootstrap recovery and artifact GC

docs/schema.md

@@ -1001,6 +1001,15 @@ classDiagram
         optional path
         optional device
         optional inode
+        optional released_state_anchor
+    }
+
+    class StateAnchorReleaseEvidence {
+        <<serialized>>
+        daemon
+        user_namespace
+        mount_namespace
+        mount
     }
 
     class StateAnchorOwnership {
@@ -1055,6 +1064,11 @@ classDiagram
     }
 
     ParticipantOwnership --> PreparedLowerOwnership
+    PreparedLowerOwnership --> StateAnchorReleaseEvidence : released_state_anchor
+    StateAnchorReleaseEvidence --> PersistedHostProcessOwnership : daemon
+    StateAnchorReleaseEvidence --> NamespaceIdentity : user_namespace
+    StateAnchorReleaseEvidence --> NamespaceIdentity : mount_namespace
+    StateAnchorReleaseEvidence --> MountIdentity : mount
     ParticipantOwnership --> StateAnchorOwnership
     ParticipantOwnership --> GitRoutingOwnership
     ParticipantOwnership --> NetworkOwnership
@@ -1103,11 +1117,13 @@ and newly acquired child slots move only `Unassigned` to `Staged` to exact
 matching current `Committed`. A current committed owner or supervisor may
 enter a newly created dependent-role snapshot directly and is then immutable.
 Recorded evidence cannot be replaced or cleared. A transition to ReleaseIntent
-preserves all evidence; PreparedLower
-changes only its lease phase to `ReleaseIntent`. ReleaseIntent becomes Clean
-only after independent absence proof and atomically clears every physical
-field. A bare Intent may become Clean only after the same sealed runtime-absence
-check.
+preserves all evidence. PreparedLower changes its lease phase to
+`ReleaseIntent` and may atomically add the exact released State Anchor daemon,
+user namespace, mount namespace, and mount evidence needed to resume physical
+release. That release evidence is immutable within ReleaseIntent. ReleaseIntent
+becomes Clean only after independent absence proof and atomically clears every
+physical field. A bare Intent may become Clean only after the same sealed
+runtime-absence check.
 
 The direct existing-process edges are Network RS, Helper RS, Sandbox HC, and
 Session Terminal HC. State Anchor daemon, Git-routing daemon, Helper process,